The three levels
- Level 1 covers Federal Contract Information (FCI). It requires 17 basic practices from FAR 52.204-21. Organizations complete an annual self-assessment and affirm the result.
- Level 2 covers Controlled Unclassified Information (CUI). It requires the 110 practices of NIST SP 800-171. Most Level 2 requirements call for a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO), with a limited set eligible for self-assessment.
- Level 3 applies to the highest-priority programs. It adds requirements from NIST SP 800-172 and is assessed by the government.
What the phases mean
CMMC was introduced in phases so the requirement could be phased in across DoD solicitations. Phase 1, which began in November 2025, allows some contracts to include CMMC requirements, with self-assessments at certain levels. Phase 2, scheduled for November 2026, expands the requirement so that most contracts involving CUI require a third-party certification at the level specified. Confirm the current dates and requirements in the solicitation itself, since the program rules and timing can change.
Why the affirmation matters
Under CMMC, a senior company official affirms compliance. A false affirmation can create liability under the False Claims Act, and that liability can attach to individuals as well as the company. Affirm only what you have verified, and keep the evidence that supports it.
Where to start
- Find the requirement. Check the DFARS clauses in your current and target contracts. DFARS 252.204-7012 requires NIST SP 800-171 safeguards, and 252.204-7019 and 7020 require a current assessment score in SPRS. DFARS 252.204-7021 is where CMMC certification is specified.
- Define your CUI boundary. Identify which systems store, process, or transmit CUI. A smaller boundary is cheaper to assess.
- Run a gap assessment against the practices for your level, and build a System Security Plan and a Plan of Action and Milestones where needed.
- Plan the certification for the level your contracts require, with enough lead time for remediation before the assessment.
Read your contracts before you read the rule. The clauses in your existing and pending contracts determine which level applies to you and when.
Frequently asked questions
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers Federal Contract Information with 17 practices and an annual self-assessment. Level 2 covers CUI with the 110 practices of NIST SP 800-171, and most require a third-party assessment.
What is the difference between FCI and CUI?
FCI is information not intended for public release that is provided by or generated for the government under a contract. CUI is government-created or government-owned information that requires safeguarding under a law, regulation, or government-wide policy.
Do I need CMMC to bid on a DoD contract?
It depends on the contract. The solicitation specifies the required level, and in Phase 2 most CUI contracts will require a current certification at that level.
What is a POA&M under CMMC?
A Plan of Action and Milestones documents open requirements, planned fixes, and deadlines. Its use is limited by the rule, and some requirements cannot be deferred.
Related articles
Want this applied to your company?
A free 30-minute scoping call tells you which frameworks apply and what it would take.